Processing necessary for compliance with legal obligations and for tasks carried out in the public interest
Pursuant to the Article 5 of the Data Protection Act, the controller may process personal data if it is necessary for compliance with a legal obligation or the performance of a task carried out in the public interest or in carrying out official authority duties vested in the controller. The purpose of this article is to explicitly clarify the personal data processing pursuant to Article 6(1)(c) and 6(1)(e) of the GDPR within the scope of Czech legislation.
Pursuant to Article 5 of the Data Protection Act, the controller may process personal data for compliance with a certain legal obligation, even if the legislation does not contain an explicit controller obligation to process personal data, should the controller’s processing of personal data be necessary due to the nature of the legal obligation.
Pursuant to Article 5 of the Data Protection Act, a similar reasoning applies to performing tasks carried out in the public interest or in carrying out official authority duties vested in the controller. The specific legislation does not need to explicitly include the obligation to process personal data for such purposes, should the controller’s processing of personal data be necessary due to the nature of the legal obligation.
Journalistic, academic, artistic and literary purposes
Pursuant to Article 17 of the Data Protection Act, personal data may be processed without data subject’s consent, in the case that the processing occurs in an adequate manner for journalistic, academic, artistic and literary purposes. The determination of the adequacy of the processing shall include an analysis of the range of personal data used for such processing purposes, in particular whether the special categories of personal data and data relating to criminal convictions and offences are to be processed.
Children’s consent
Pursuant to the Article 7 of the Data Protection Act, in relation to offering information society services directly to a child, the processing of the personal data of a child based on the child’s consent shall be lawful where the child is at least 15 years old.
